CVE-2023-26126

All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the requestFile function.

Affected

m.static

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1 SNYK

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.99% chance of exploitation in the next 30 days, 62nd percentile

Published

2023-05-10

Updated

2025-01-27

Proof-of-concept exploits (2)

• https://gist.github.com/lirantal/dcb32c11ce87f5aafd2282b90b4dc998
• https://security.snyk.io/vuln/SNYK-JS-MSTATIC-3244915

Security advisories

• advisories/GHSA-vcxh-qvgr-9fw9

References

• CVE Record
• NVD entry